4a1f69a8e5
Some checks failed
Deploy to Phoenix / deploy (push) Failing after 5s
phoenix-deploy Deploy failed: Command failed: bash scripts/deployment/phoenix-deploy-currencicombo-from-workspace.sh
[currencicombo-phoenix] packing s
253 lines
11 KiB
Bash
Executable File
253 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# install.sh — idempotent first-time setup for CurrenciCombo on a systemd host.
|
|
#
|
|
# Intended to run ONCE per host as root (or with sudo). Running it again is
|
|
# safe: it will skip already-present artifacts and warn on conflicts.
|
|
#
|
|
# What this does:
|
|
# 1. Creates the `currencicombo` system user and /opt/currencicombo tree.
|
|
# 2. Installs nginx (Debian/Ubuntu or Alpine) if not present.
|
|
# 3. Ensures a local Postgres is running and creates a fresh
|
|
# `currencicombo` role + DB (refuses to touch an existing one unless
|
|
# --force-recreate is passed).
|
|
# 4. Ensures a local Redis is running.
|
|
# 5. Writes /etc/currencicombo/orchestrator.env from .env.prod.example,
|
|
# auto-populating EVENT_SIGNING_SECRET and ORCHESTRATOR_API_KEYS with
|
|
# fresh randoms the first time.
|
|
# 6. Installs /etc/currencicombo/webapp-nginx.conf.
|
|
# 7. Installs the two systemd units and runs `systemctl daemon-reload`.
|
|
# 8. Enables (does NOT start) both units. First start happens via
|
|
# scripts/deployment/deploy-currencicombo-8604.sh after the first
|
|
# successful build.
|
|
#
|
|
# This script is target-agnostic. It has no hardcoded IP / hostname /
|
|
# VLAN. The NPMplus ingress in front of it is configured separately —
|
|
# see scripts/deployment/README.md.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
|
APP_USER="currencicombo"
|
|
APP_HOME="/opt/currencicombo"
|
|
ETC_DIR="/etc/currencicombo"
|
|
LOG_DIR="/var/log/currencicombo"
|
|
REPO_DIR="/var/lib/currencicombo/repo"
|
|
ENV_FILE="${ETC_DIR}/orchestrator.env"
|
|
NGINX_FILE="${ETC_DIR}/webapp-nginx.conf"
|
|
SYSTEMD_DIR="/etc/systemd/system"
|
|
|
|
FORCE_RECREATE_DB=0
|
|
DRY_RUN=0
|
|
SKIP_NGINX_INSTALL=0
|
|
|
|
log() { printf '[install] %s\n' "$*" >&2; }
|
|
warn() { printf '[install][WARN] %s\n' "$*" >&2; }
|
|
die() { printf '[install][FATAL] %s\n' "$*" >&2; exit 1; }
|
|
run() { if [[ "${DRY_RUN}" -eq 1 ]]; then printf '[install][dry-run] %s\n' "$*" >&2; else eval "$*"; fi; }
|
|
sql_escape() {
|
|
printf "%s" "$1" | sed "s/'/''/g"
|
|
}
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Usage: sudo ./install.sh [--force-recreate-db] [--skip-nginx-install] [--dry-run]
|
|
|
|
--force-recreate-db DROP and recreate the currencicombo Postgres role
|
|
and DB even if they already exist. DESTRUCTIVE.
|
|
--skip-nginx-install Do not apt/apk install nginx (use if you already
|
|
have a custom nginx build in place).
|
|
--dry-run Print the commands that would run, don't run them.
|
|
USAGE
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--force-recreate-db) FORCE_RECREATE_DB=1; shift ;;
|
|
--skip-nginx-install) SKIP_NGINX_INSTALL=1; shift ;;
|
|
--dry-run) DRY_RUN=1; shift ;;
|
|
-h|--help) usage; exit 0 ;;
|
|
*) die "unknown arg: $1" ;;
|
|
esac
|
|
done
|
|
|
|
[[ "$EUID" -eq 0 ]] || die "must run as root (sudo)"
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 1. User + tree
|
|
# ----------------------------------------------------------------------
|
|
if id "${APP_USER}" >/dev/null 2>&1; then
|
|
log "user ${APP_USER} already exists"
|
|
else
|
|
log "creating system user ${APP_USER}"
|
|
run useradd --system --home-dir "${APP_HOME}" --shell /usr/sbin/nologin --user-group "${APP_USER}"
|
|
fi
|
|
|
|
for d in "${APP_HOME}" "${APP_HOME}/orchestrator" "${APP_HOME}/webapp" \
|
|
"${APP_HOME}/webapp/dist" "${ETC_DIR}" "${LOG_DIR}" "${REPO_DIR}"; do
|
|
run install -d -o "${APP_USER}" -g "${APP_USER}" -m 0755 "$d"
|
|
done
|
|
run chown "${APP_USER}:${APP_USER}" "${APP_HOME}" "${LOG_DIR}" "${REPO_DIR}"
|
|
run chmod 0750 "${ETC_DIR}"
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 2. nginx (required by currencicombo-webapp.service)
|
|
# ----------------------------------------------------------------------
|
|
if [[ "${SKIP_NGINX_INSTALL}" -eq 0 ]]; then
|
|
if command -v nginx >/dev/null 2>&1; then
|
|
log "nginx already installed ($(nginx -v 2>&1 | head -1))"
|
|
elif command -v apt-get >/dev/null 2>&1; then
|
|
log "installing nginx via apt"
|
|
run 'DEBIAN_FRONTEND=noninteractive apt-get update -q'
|
|
run 'DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends nginx-light'
|
|
# We use our own nginx.conf via -c, so disable the distro site.
|
|
run systemctl disable --now nginx 2>/dev/null || true
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
log "installing nginx via apk"
|
|
run apk add --no-cache nginx
|
|
run rc-update del nginx 2>/dev/null || true
|
|
else
|
|
die "no apt or apk available — install nginx manually or re-run with --skip-nginx-install"
|
|
fi
|
|
fi
|
|
[[ -f /etc/nginx/mime.types ]] || warn "/etc/nginx/mime.types missing; webapp-nginx.conf may fail"
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 3. Postgres role + DB
|
|
# ----------------------------------------------------------------------
|
|
if ! command -v psql >/dev/null 2>&1; then
|
|
die "psql not on PATH — install Postgres on this host (e.g. apt install postgresql) before running install.sh"
|
|
fi
|
|
|
|
# Use the OS `postgres` superuser for DDL.
|
|
pg_role_exists() {
|
|
sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${APP_USER}';" 2>/dev/null | grep -q 1
|
|
}
|
|
pg_db_exists() {
|
|
sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='${APP_USER}';" 2>/dev/null | grep -q 1
|
|
}
|
|
|
|
if pg_role_exists; then
|
|
if [[ "${FORCE_RECREATE_DB}" -eq 1 ]]; then
|
|
log "dropping existing role/DB (--force-recreate-db)"
|
|
run "sudo -u postgres psql -c 'DROP DATABASE IF EXISTS ${APP_USER};'"
|
|
run "sudo -u postgres psql -c 'DROP ROLE IF EXISTS ${APP_USER};'"
|
|
else
|
|
warn "Postgres role ${APP_USER} already exists — skipping role/DB creation. Re-run with --force-recreate-db to wipe."
|
|
fi
|
|
fi
|
|
|
|
if ! pg_role_exists; then
|
|
log "creating Postgres role ${APP_USER}"
|
|
run "sudo -u postgres psql -c \"CREATE ROLE ${APP_USER} LOGIN;\""
|
|
fi
|
|
if ! pg_db_exists; then
|
|
log "creating Postgres database ${APP_USER}"
|
|
run "sudo -u postgres psql -c \"CREATE DATABASE ${APP_USER} OWNER ${APP_USER};\""
|
|
fi
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 4. Redis
|
|
# ----------------------------------------------------------------------
|
|
if systemctl list-unit-files | grep -q '^redis-server\.service'; then
|
|
run "systemctl start redis-server.service || true"
|
|
run "systemctl enable redis-server.service >/dev/null 2>&1 || true"
|
|
elif systemctl list-unit-files | grep -q '^redis\.service'; then
|
|
run "systemctl start redis.service || true"
|
|
run "systemctl enable redis.service >/dev/null 2>&1 || true"
|
|
elif command -v redis-cli >/dev/null 2>&1; then
|
|
warn "redis-cli present but no redis-server.service / redis.service unit — assuming external Redis"
|
|
else
|
|
warn "redis not detected; orchestrator will fall back to in-process event bus. Install redis for multi-replica support."
|
|
fi
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 5. orchestrator.env
|
|
# ----------------------------------------------------------------------
|
|
FIRST_KEYS_FILE="/root/currencicombo-first-keys.txt"
|
|
if [[ -f "${ENV_FILE}" ]]; then
|
|
log "${ENV_FILE} already exists — leaving alone (no new keys generated)"
|
|
else
|
|
log "writing ${ENV_FILE}"
|
|
install -o "${APP_USER}" -g "${APP_USER}" -m 0640 "${SCRIPT_DIR}/.env.prod.example" "${ENV_FILE}"
|
|
# Auto-fill the two REQUIRED secrets so first boot doesn't crash.
|
|
SECRET="$(openssl rand -hex 32)"
|
|
INIT_KEY="$(openssl rand -hex 24)"
|
|
SETT_KEY="$(openssl rand -hex 24)"
|
|
AUD_KEY="$(openssl rand -hex 24)"
|
|
DB_PASSWORD="$(openssl rand -hex 24)"
|
|
DB_PASSWORD_SQL="$(sql_escape "${DB_PASSWORD}")"
|
|
API_KEYS_VALUE="${INIT_KEY}:initiator,${SETT_KEY}:settler,${AUD_KEY}:auditor"
|
|
DATABASE_URL="postgresql://${APP_USER}:${DB_PASSWORD}@127.0.0.1:5432/${APP_USER}"
|
|
log "setting Postgres password for role ${APP_USER}"
|
|
run "sudo -u postgres psql -c \"ALTER ROLE ${APP_USER} WITH LOGIN PASSWORD '${DB_PASSWORD_SQL}';\""
|
|
run "sed -i 's|^EVENT_SIGNING_SECRET=.*|EVENT_SIGNING_SECRET=${SECRET}|' '${ENV_FILE}'"
|
|
run "sed -i 's|^API_KEYS=.*|API_KEYS=${API_KEYS_VALUE}|' '${ENV_FILE}'"
|
|
run "sed -i 's|^DATABASE_URL=.*|DATABASE_URL=${DATABASE_URL}|' '${ENV_FILE}'"
|
|
run "grep -q '^ORCHESTRATOR_API_KEYS=' '${ENV_FILE}' && sed -i 's|^ORCHESTRATOR_API_KEYS=.*|ORCHESTRATOR_API_KEYS=${API_KEYS_VALUE}|' '${ENV_FILE}' || printf '\nORCHESTRATOR_API_KEYS=%s\n' '${API_KEYS_VALUE}' >> '${ENV_FILE}'"
|
|
# Write a root-only handoff file so ops can grab the keys without
|
|
# scraping journald or reading the env file. The canonical copy lives
|
|
# in ${ENV_FILE}; delete this file once the keys are in your password
|
|
# manager.
|
|
if [[ "${DRY_RUN}" -eq 0 ]]; then
|
|
umask 077
|
|
cat > "${FIRST_KEYS_FILE}" <<EOF
|
|
# CurrenciCombo first-deploy secrets — generated $(date -Iseconds) by install.sh
|
|
#
|
|
# This file contains the initial API keys and event-signing secret for the
|
|
# orchestrator. The canonical live values live in ${ENV_FILE} and are what
|
|
# systemd actually loads. This file is a root-only handoff copy — record
|
|
# these values in your password manager, then:
|
|
#
|
|
# shred -u ${FIRST_KEYS_FILE}
|
|
#
|
|
# Re-running install.sh does NOT regenerate these values if ${ENV_FILE}
|
|
# already exists. Losing both ${FIRST_KEYS_FILE} and ${ENV_FILE} means
|
|
# rotating all three API keys and the signing secret.
|
|
|
|
EVENT_SIGNING_SECRET=${SECRET}
|
|
ORCHESTRATOR_API_KEY_INITIATOR=${INIT_KEY}
|
|
ORCHESTRATOR_API_KEY_SETTLER=${SETT_KEY}
|
|
ORCHESTRATOR_API_KEY_AUDITOR=${AUD_KEY}
|
|
DATABASE_URL=${DATABASE_URL}
|
|
|
|
# As it appears in ${ENV_FILE}:
|
|
API_KEYS=${API_KEYS_VALUE}
|
|
ORCHESTRATOR_API_KEYS=${API_KEYS_VALUE}
|
|
EOF
|
|
chmod 0600 "${FIRST_KEYS_FILE}"
|
|
chown root:root "${FIRST_KEYS_FILE}"
|
|
else
|
|
log "[dry-run] would write ${FIRST_KEYS_FILE} (0600, root:root)"
|
|
fi
|
|
log " generated EVENT_SIGNING_SECRET (64 hex)"
|
|
log " generated 3 API keys (initiator/settler/auditor)"
|
|
log " generated local Postgres password for ${APP_USER}"
|
|
log " initial secrets written to ${FIRST_KEYS_FILE} (0600) — record in password manager, then 'shred -u ${FIRST_KEYS_FILE}'"
|
|
fi
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 6. webapp-nginx.conf
|
|
# ----------------------------------------------------------------------
|
|
run install -o "${APP_USER}" -g "${APP_USER}" -m 0644 \
|
|
"${SCRIPT_DIR}/webapp-nginx.conf" "${NGINX_FILE}"
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 7. systemd units
|
|
# ----------------------------------------------------------------------
|
|
run install -o root -g root -m 0644 \
|
|
"${SCRIPT_DIR}/systemd/currencicombo-orchestrator.service" \
|
|
"${SYSTEMD_DIR}/currencicombo-orchestrator.service"
|
|
run install -o root -g root -m 0644 \
|
|
"${SCRIPT_DIR}/systemd/currencicombo-webapp.service" \
|
|
"${SYSTEMD_DIR}/currencicombo-webapp.service"
|
|
run systemctl daemon-reload
|
|
|
|
# ----------------------------------------------------------------------
|
|
# 8. Enable (but do NOT start yet — no build exists)
|
|
# ----------------------------------------------------------------------
|
|
run systemctl enable currencicombo-orchestrator.service
|
|
run systemctl enable currencicombo-webapp.service
|
|
|
|
log "install complete."
|
|
log " next: run scripts/deployment/deploy-currencicombo-8604.sh as root to build + start."
|